v1.36.2

Orbis v1.36.2

Added

• Devices get their names from your router. In observe mode Orbis never sees DHCP, so devices read as
  bare addresses. It now asks the router what it calls each one.
• Act from the row. The DNS log, Connections and a device's lookups have Allow, Block and Why on each
  row, with Undo. A live list holds still while the pointer is on it, so a click lands where you aimed. A
  device can be marked trusted from its own page.

Changed

• Country codes replace emoji flags.

Fixed

• Orbis never saw a Pi running short of power. It read a file that says 0 on some kernels. It now asks
  the firmware, and low voltage shows in Needs you, since it can corrupt the SD card.
• Anyone on the network could lock you out of the dashboard. A crafted request to the block page made
  Orbis treat its own address as a blocked site, and no sign-in was needed. Only a real lookup can do that now.
• Asking to unblock could reach further than the page showed. A request could name something never
  blocked, or a whole suffix like co.uk. Now it has to be blocked for that device, and not a public suffix.
• Threat lists were hidden by ad lists. A name on both read as an ad, so it could be opened for everyone,
  for good, and approving a site also opened anything under it on a threat list. Encrypted DNS services now
  count as threats too.
• Trust followed the address. A guest who took a trusted device's address could unblock sites. Orbis now
  checks the device's hardware address, and logs each one. Threat-listed sites also notify you.
• Notifications could be forged. A device's hostname could add mail headers, and a note could ping a
  whole Slack or Discord channel or dress up a link.
• Smaller. An oversized post to an approval link is refused before it is read, a negative length no
  longer means forever, a request left unanswered for a day cannot be approved, and grants are checked without a lock, so a slow SD card cannot hold up DNS.
• Undo could delete your own rule. Allowing or blocking replaces any rule already on that name, and Undo
  removed it outright. It now puts the old rule back.
• A device's network switch read backwards. It sat off while the device had access, and repeated the
  Block device button beside it, so it is gone.
• A restart after changing lists left the network unfiltered. Removing a list happened before the
  block index loaded, which on the reference Pi meant about seven minutes with nothing blocked. The saved
  index now loads first and keeps filtering, even if it is slightly out of date, until the rebuild lands.

---

Install on a Debian/Ubuntu host, VM or LXC:

curl -fsSL https://raw.githubusercontent.com/Neoo-Blue/orbis/main/deploy/bootstrap.sh | sudo bash

Docker:

docker run -d --network host --cap-add NET_ADMIN --cap-add NET_RAW \
  -v orbis-config:/etc/orbis -v orbis-data:/var/lib/orbis \
  ghcr.io/neoo-blue/orbis:stable

Already running Orbis? It offers this release itself: Settings, About & diagnostics, Update now. Or sudo orbisd -update.

v1.36.1

Orbis v1.36.1

Fixed

• Aggressive lists could break Amazon's shopping app. They block the service that turns on features
  in the app, which has a built-in exception now. Amazon's tracking stays blocked.

---

Install on a Debian/Ubuntu host, VM or LXC:

curl -fsSL https://raw.githubusercontent.com/Neoo-Blue/orbis/main/deploy/bootstrap.sh | sudo bash

Docker:

docker run -d --network host --cap-add NET_ADMIN --cap-add NET_RAW \
  -v orbis-config:/etc/orbis -v orbis-data:/var/lib/orbis \
  ghcr.io/neoo-blue/orbis:stable

Already running Orbis? It offers this release itself: Settings, About & diagnostics, Update now. Or sudo orbisd -update.

v1.36.0

Orbis v1.36.0

Orbis is now far easier to get around, it moves, and a blocked site can be asked for and opened in one
tap.

Added

• Ask to unblock. The block page has a button to ask for the site, with an optional note. Whoever
  runs the network answers 1 hour, Today, Always or Deny from Needs you on the Overview, from
  Protection, Requests, or from a one-tap link in a notification that needs no sign-in. The person
  waiting does nothing: their page opens the site by itself, though a browser can take up to a minute
  to let go of the old answer.
• Answer from your phone. Protection, Requests sets up ntfy, a free push app with no account and
  nothing opened on your network. Each request arrives with Allow 1 hour and Deny on the notification
  itself. The buttons need the phone on home Wi-Fi or Tailscale.
• Trusted devices. Mark your own devices under Protection, Requests and their block page offers
  Unblock for an hour with no request.
• Approvals are their own thing. Each one covers one device for a set time unless you say
  otherwise, ends by itself, and can be ended early under Open right now. No blocklist is touched. A
  site on a threat list takes a second tap and is limited to one device for a limited time.
• Why, in place. A stopped row on the Overview or in the DNS log opens the decision in a drawer,
  with Allow or Block right there and Undo afterwards.

Changed

• Six sections instead of 29 links: Overview, Traffic, Devices, Protection, Network and System,
  with each section's pages as tabs. A section remembers the tab you left it on, every old link still
  works, and 1 to 6, the [ and ] keys and / move around without the mouse.
• Going back is instant. The last eight pages stay ready, keeping their filters and scroll
  position, and page code is fetched before you ask for it.
• It moves. Pages slide the way the navigation is laid out, markers glide between tabs, numbers
  run to their new value, new rows arrive, drawers and toasts come and go, and loading holds the shape
  of the page. The Overview chart draws itself in, shows traffic travelling along its lines and keeps a
  slow watch round the shield. All of it stops if your system asks for reduced motion.
• The Overview answers to the pointer. Hovering a device or a stopped site lights it on the chart
  and in the lists, rows carry Allow and Pause, the history has a value under the pointer and a range
  to pick, and a device opens over the chart.

Fixed

• The block page could not appear on a device without the Orbis certificate. Such a device was sent
  the sinkhole, which also shut off plain http. It now fails HTTPS at once and keeps the page, so a
  browser falling back from https shows it.
• Hosted apps crashed on a node with no storage devices.
• Aggressive lists broke the Facebook app. They block b-graph.facebook.com, the server the app
  depends on, along with its fallback and live connection. Those three now have a built-in exception,
  while Facebook's real trackers stay blocked.
• Orbis told Firefox it could skip the filter. Firefox asks use-application-dns.net whether a
  network allows encrypted DNS, and any answer, even a block, means yes. It now gets NXDOMAIN, the
  agreed no, so Firefox stays on the network's resolver unless someone has forced it on.

---

Install on a Debian/Ubuntu host, VM or LXC:

curl -fsSL https://raw.githubusercontent.com/Neoo-Blue/orbis/main/deploy/bootstrap.sh | sudo bash

Docker:

docker run -d --network host --cap-add NET_ADMIN --cap-add NET_RAW \
  -v orbis-config:/etc/orbis -v orbis-data:/var/lib/orbis \
  ghcr.io/neoo-blue/orbis:stable

Already running Orbis? It offers this release itself: Settings, About & diagnostics, Update now. Or sudo orbisd -update.

v1.35.0

Orbis v1.35.0

The interface is new, DNS is never stale, and the whole node does far less work. On the reference
Raspberry Pi 4: forwarded lookups fell from 79 ms to about 20 ms, cached ones from 2.5 ms to under
1 ms, the Go heap from about 600 MB to about 130 MB, and no log rows are dropped.

Added

• The block page. A browser opening a blocked site gets a page saying what stopped it: the
  rule, the list, the device, and one line drawn from the device through each stage to the decision,
  with a link to review it in Orbis. It works on plain http for everyone, and on https for devices
  that trust the Orbis certificate. A device that refuses the certificate is detected after three
  tries and goes back to failing quietly for a day, so nobody is left looking at certificate
  warnings, and an ad inside someone else's page still fails silently. Only a name blocked in its
  own right gets the page. A name that merely leads to a blocked one, or sits in a blocked country,
  keeps the plain sinkhole: that name belongs to whoever runs it, and pointing it at this node would
  hand their page the node's origin. Settings, DNS, "Show a page when a site is blocked".
• The orbit chart. The Overview now answers "is my network safe?" in one sentence, beside a
  live map of the network: Orbis at the centre, devices on their orbits by what they are, each
  reaching the world through the gateway, and traffic running round the rim in one line per region
  as thick as the bytes on it. Blocked lookups stop at the shield and leave a mark you can open. Every
  warning now sits in one list, Needs you, beside what was just stopped. Simple mode's Home carries
  the chart too.
• Internet health. Continuous monitoring of the gateway and public resolvers, with latency,
  jitter, loss, 24 hours of history and an outage log. It tells you in one sentence whether a
  problem is your network or your provider.
• Change timeline. Every saved configuration is kept, the last 200 of them, with what changed and
  a line-by-line comparison, secrets hidden. Restore any version in one click. For anything touching
  the network it asks you to confirm within 60 seconds and rolls itself back if you cannot, so a
  change that cuts you off undoes itself, even if the node restarts or loses power in that minute.
  The rollback reloads the firewall too. Config edits are refused while a restore waits, and it
  tells you which changes only take effect after a restart, because the timer cannot test those.
  Neither a restore nor a rollback brings back an old admin password.
• Zone matrix. Firewall, Zone matrix: a grid of what happens between every pair of zones, with
  the rules that apply and the last hour of traffic in each cell. On a node in observe mode it says
  this is what would apply, not what is applied.
• Every decision can be traced. A blocked row in the DNS log, or a mark on the orbit chart's
  shield, opens the same route line the block page draws.

Changed

• A new look across both interfaces: a star-atlas plate, Prussian blue with brass hairlines,
  jade for safe and vermilion for blocked, violet kept for a traced decision, set in Geist.
  Destructive buttons stay outlined until you mean it. The fonts are built in; the interface still
  makes no outside requests.
• Restarts are quick. The built block index is kept on disk, so filtering is back within seconds
  rather than after two and a half minutes, and shutdown no longer waits out its 20 second timeout.
• Vermilion means a block or a threat, nothing else. Faults such as a lost gateway are amber, so
  anything red on screen can be opened and traced to what decided it. The Overview's sentence, its
  mark and the chart's lines all share one state, so a fault can never sit on the safe colour.
• The Overview says what each layer is doing: DNS filtering, firewall, in-stream ads and threat
  feeds, each on, off or not enforced. Node CPU, memory and temperature moved into Subsystems.
• The firewall opens ports 80 and 443 to your lan and vpn zones when the block page is on, in inline
  mode. Everything else from your non-WAN zones gets a reset, so a blocked name fails at once on every
  port and in every zone rather than timing out. Guest and IoT zones still cannot reach the interface.
• Traffic to Orbis itself skips the filter proxy, so the block page sees the real device.
• URLhaus now comes from AdGuard's compiled feed. abuse.ch withdrew its free downloads. Existing
  installs move over on their own. 1Hosts (mini) switches itself off: it has been empty since March 2025.
• Lists refresh together, overnight. A pass takes everything due soon, between 02:00 and 05:00
  local time, and a list that has not changed costs nothing. Lists used to drift onto separate
  clocks, which rebuilt the whole index about once an hour.
• Upstream DNS connections stay open. Each miss used to pay seven TLS handshakes.
• dns.min_ttl is gone. It is ignored if present. Raising a TTL is what served a 60 second record
  for an hour.

Fixed

• NXDOMAIN reached clients as an empty success, and so did SERVFAIL from an upstream. Every dead
  name on the network looked like a live one with no address.
• The first upstream reply won the race even when it was SERVFAIL or a stale NXDOMAIN. A real
  answer now wins outright, and "does not exist" needs a majority of resolvers.
• A list refresh stopped all logging. Each refresh rewrote the whole list in one transaction,
  which held the write lock for over 30 minutes on the largest list and dropped 125,000 log rows
  a day. Refreshes now write only what changed, in short transactions. This is also what tripped
  the interception load guard.
• The write-ahead log grew past 1 GB and is now cut back once it has been checkpointed.
• A geo repair held the database write lock for minutes after every boot. Logging stopped, devices
  and open ports failed to save with "database is locked", and a restart in that window waited out
  the 20 second shutdown timeout with DNS already down. It now runs only when a GeoIP database
  changes, reads and writes in small steps without holding the lock, and stops with the daemon.
• A list download cut short by a restart was reported as a failed list.
• Cloaked trackers went upstream on every lookup, because blocked CNAME answers were never
  cached. They now cost one query per TTL, and a rule change reaches what is already cached.
• Every cached and allowed lookup scanned all 1,200 list regexes, 2.5 ms a time on a Pi. A verdict
  is now remembered per name.
• Lists answering "not modified" were fetched again every hour.
• Answers larger than the client asked for were sent over UDP anyway, the EDNS flags of cached
  answers were being rewritten, and client cookies were forwarded to upstream resolvers.
• Losing a race counted as a failure, which took slower resolvers out of the pool.

Faster

• Live events reach only the page that wants them, so the shell no longer re-renders four times a
  second. Opening Orbis takes one round trip instead of three, /api/status no longer forks
  tailscale on every poll, and hidden or paused views stop fetching.
• Flows are written every 30 seconds rather than 5, and repeat updates of one flow coalesce, which
  cuts most of the node's writes. A redundant index on the blocklist table is gone.
• The block list index needs about a fifth of the memory and nothing for the garbage collector to
  scan.
• The globe keeps its markers instead of rebuilding them on every live tick, hover is once a frame,
  and the flat map stops drawing when hidden.

---

Install on a Debian/Ubuntu host, VM or LXC:

curl -fsSL https://raw.githubusercontent.com/Neoo-Blue/orbis/main/deploy/bootstrap.sh | sudo bash

Docker:

docker run -d --network host --cap-add NET_ADMIN --cap-add NET_RAW \
  -v orbis-config:/etc/orbis -v orbis-data:/var/lib/orbis \
  ghcr.io/neoo-blue/orbis:stable

Already running Orbis? It offers this release itself: Settings, About & diagnostics, Update now. Or sudo orbisd -update.

v1.34.0

Orbis v1.34.0

Added

• Smart unblock. Settings, Assistant, TypeSafe: "Suggest unblocks for blocks that break things".
  Every hour TypeSafe is asked what the names your devices keep getting refused are for. A
  push-notification, sign-in, app, update or content host that only one to three ad lists block is
  probably collateral damage from an aggressive list, and becomes an allow suggestion on the
  Assistant page. Turn on "Unblock the clearest ones automatically" and push, sign-in, app and
  update hosts blocked by one or two lists are allowed at once: at most three a day, each announced
  as an event, undoable from the Assistant page (an undone name is never unblocked automatically
  again), and withdrawn after a week unless something still uses it. Names on malware or DNS-bypass
  lists, Orbis's own policy blocks and your own blocks are never touched.
• TypeSafe triages anomaly alerts. With TypeSafe on and AI triage enabled, each finding is
  judged on its own against the device and the destination's name, port, country and network
  operator. One with an ordinary explanation (update checks, sync, push, a tunnel you run,
  peer-to-peer) is lowered to notice or info; one with none keeps the detector's severity. It
  never raises a finding.
• Unknown devices get a type. Virtual machines and containers (Proxmox, VMware, Xen and
  Parallels network cards) are recognised as servers. With "Identify unknown devices" on,
  TypeSafe names the rest from their hostname, vendor and the names they look up most: a device
  resolving Samsung TV services is a TV, one calling a robot-vacuum API is an appliance. A
  classification is only applied when TypeSafe is at least 60% sure, and never replaces one the
  built-in rules made.

Fixed

• No more "regular check-in" alerts for traffic inside your own network. The beaconing
  detector flagged devices talking to this node, the router, the broadcast address and tailnet
  peers; on one home network that was 85 of 752 alerts in a week. Only destinations out on the
  internet are considered now.
• A DHCP lease arriving while a device was being read could crash the daemon. Every copy of
  a device the registry handed out shared its details map with the live record, which a new
  lease writes to. Copies now own their details.

---

Install on a Debian/Ubuntu host, VM or LXC:

curl -fsSL https://raw.githubusercontent.com/Neoo-Blue/orbis/main/deploy/bootstrap.sh | sudo bash

Docker:

docker run -d --network host --cap-add NET_ADMIN --cap-add NET_RAW \
  -v orbis-config:/etc/orbis -v orbis-data:/var/lib/orbis \
  ghcr.io/neoo-blue/orbis:stable

Already running Orbis? It offers this release itself: Settings, About & diagnostics, Update now. Or sudo orbisd -update.

v1.33.0

Orbis v1.33.0

Added

• TypeSafe can judge ad and tracker hosts. Settings, Assistant, TypeSafe domain judge: turn it
  on and paste a key from console.typesafe.ai. Smart capture and the domain tester's "Ask the
  assistant" then ask TypeSafe's Jev model two typed questions per host (is it ad or tracking
  infrastructure, and how likely is a block to break something) and get calibrated probabilities
  back in about a third of a second, at a fraction of a cent per thousand hosts. It works with no
  chat model configured; when one is, it takes over if TypeSafe fails. Chat, briefs and reviews
  are unchanged.

Fixed

• Smart capture now asks the model about hosts it only saw in DNS. Its heuristics measure
  referrers, response sizes and paths, so a host seen only as DNS lookups scored zero for lack
  of evidence and the model was never consulted; on a DNS-only node no candidate was ever
  judged. Each such host is now asked about once. Because a verdict on the name alone has
  nothing to be blended with, it stands on its own, and it can only send the host to review,
  never block it. Hosts waiting for review no longer crowd unjudged ones out of each pass.
• A host keeps its smart-capture evidence through a quiet interval. Referrers, response
  sizes and paths seen on an earlier pass used to be overwritten by the next pass that saw only
  DNS, so a likely beacon's score fell back toward zero whenever it went quiet for 15 minutes.

Changed

• The installer's output is easier to read. Steps in cyan, warnings in yellow, errors in red,
  the success line and the address to open in bold green, secondary lines dimmed; the daemon's
  own log lines while it writes the units and systemd's symlink message are silenced unless
  something fails. Colour is skipped when the output is not a terminal or NO_COLOR is set.

---

Install on a Debian/Ubuntu host, VM or LXC:

curl -fsSL https://raw.githubusercontent.com/Neoo-Blue/orbis/main/deploy/bootstrap.sh | sudo bash

Docker:

docker run -d --network host --cap-add NET_ADMIN --cap-add NET_RAW \
  -v orbis-config:/etc/orbis -v orbis-data:/var/lib/orbis \
  ghcr.io/neoo-blue/orbis:stable

Already running Orbis? It offers this release itself: Settings, About & diagnostics, Update now. Or sudo orbisd -update.

v1.32.1

Orbis v1.32.1

Fixed

• Explain, Ask about a domain, Run review, Write a brief and Run an assessment no longer fail
  through the tunnel. Each ran the model chain inside the request, up to two minutes on the
  free models, longer than Cloudflare waits for an origin, so from outside the LAN they came
  back as a 502 page. They now start in the background, the page asks again every few seconds,
  and the answer is handed back when it is ready. A client that gives up no longer cancels the
  work, and a second click while one runs joins it instead of starting another.

---

Install on a Debian/Ubuntu host, VM or LXC:

curl -fsSL https://raw.githubusercontent.com/Neoo-Blue/orbis/main/deploy/bootstrap.sh | sudo bash

Docker:

docker run -d --network host --cap-add NET_ADMIN --cap-add NET_RAW \
  -v orbis-config:/etc/orbis -v orbis-data:/var/lib/orbis \
  ghcr.io/neoo-blue/orbis:stable

Already running Orbis? It offers this release itself: Settings, About & diagnostics, Update now. Or sudo orbisd -update.

v1.32.0

Orbis v1.32.0

Added

• A guided first run. The first screen after install sets everything a new node needs, in
  eleven short steps with a sensible default at each: the admin password (now, or skip and set
  it later), the node's name, time zone and location, simple or advanced interface, watch-only
  or gateway, what to run, the upstream resolvers, blocklist presets, the optional assistant and
  notifications, and finally the node's address to point the router at, with the placement check
  updating live as devices start using it. Optional steps can be skipped, a reload resumes where
  you were, and nothing secret is kept in the browser between reloads.
• The one-line installer installs the latest release rather than the nightly build
  (CHANNEL=nightly keeps the old behaviour), handles Arch, Fedora and openSUSE package names as
  well as Debian and Ubuntu, refuses cleanly on hosts without systemd with a pointer to the
  Docker path, warns on WSL where the node cannot see the LAN, persists every kernel setting the
  daemon needs and loads nf_conntrack at boot so they apply, waits for the service to answer
  before claiming success, and ends with the address to open and what the guided setup will do.

Fixed

• A request no longer waits behind a blocklist import to write its audit entry. On a fresh
  node the default lists import for a minute or more; every step of the wizard, and any other
  audited action, waited on that lock for five seconds or more. Audit rows are written off the
  request now.

---

Install on a Debian/Ubuntu host, VM or LXC:

curl -fsSL https://raw.githubusercontent.com/Neoo-Blue/orbis/main/deploy/bootstrap.sh | sudo bash

Docker:

docker run -d --network host --cap-add NET_ADMIN --cap-add NET_RAW \
  -v orbis-config:/etc/orbis -v orbis-data:/var/lib/orbis \
  ghcr.io/neoo-blue/orbis:stable

Already running Orbis? It offers this release itself: Settings, About & diagnostics, Update now. Or sudo orbisd -update.

v1.31.0

Orbis v1.31.0

Added

• The globe colours connections by what they are for. Streaming, social and messaging,
  gaming, web, DNS and other each have their own colour, chosen from the connection's service,
  app, name and port, so a household can see at a glance what the network is doing. The legend
  and the connection card name the kind. A blocked connection stays red in every colouring, so a
  rejected connection is always visible as one. The old colouring by verdict (allowed, blocked,
  filtered) is a toggle in the globe controls, and the choice is remembered.

---

Install on a Debian/Ubuntu host, VM or LXC:

curl -fsSL https://raw.githubusercontent.com/Neoo-Blue/orbis/main/deploy/bootstrap.sh | sudo bash

Docker:

docker run -d --network host --cap-add NET_ADMIN --cap-add NET_RAW \
  -v orbis-config:/etc/orbis -v orbis-data:/var/lib/orbis \
  ghcr.io/neoo-blue/orbis:stable

Already running Orbis? It offers this release itself: Settings, About & diagnostics, Update now. Or sudo orbisd -update.

v1.30.6

Orbis v1.30.6

Fixed

• Applying the kernel settings really persists them now. 1.30.5 wrote the files but the
  daemon's hardened unit mounts /etc read-only, so the write failed silently while Apply
  reported success. The unit now allows /etc/sysctl.d and /etc/modules-load.d (a drop-in
  on already-installed nodes: ReadWritePaths=/etc/sysctl.d /etc/modules-load.d), and Apply
  reports persisted with the reason when it could not.

---

Install on a Debian/Ubuntu host, VM or LXC:

curl -fsSL https://raw.githubusercontent.com/Neoo-Blue/orbis/main/deploy/bootstrap.sh | sudo bash

Docker:

docker run -d --network host --cap-add NET_ADMIN --cap-add NET_RAW \
  -v orbis-config:/etc/orbis -v orbis-data:/var/lib/orbis \
  ghcr.io/neoo-blue/orbis:stable

Already running Orbis? It offers this release itself: Settings, About & diagnostics, Update now. Or sudo orbisd -update.